Flashcards
Unit 1.2 / Threats and Attacks / Study Notes
Flashcards do conjunto (48)
- 1Accounting (or accountability or auditing)Recording when and by whom a resource was accessed.
Accomplished through:
1. Logs
2. Surveillance
3.Incident Reporting - 2Social Engineeringgetting users to reveal confidential information.
- 3Impersonationpretending to be someone else
- 4Social Engineering Principles1. Familiarity / Liking
2. Consensus / Social Proof
3. Authority and Intimidation
3. Scarcity and Urgency - 5Familiarity / Likingnatural charisma that allows potential attacker to persuade others to do as they request.
- 6Consensus / Social ProofThe fact that without an explicit instruction to behave in a certain way, many people will act just as they think others would act.
- 7Authority and IntimidationMany people find it difficult to refuse a request by someone they perceive as superior in rank or expertise.
- 8Scarcity and UrgencyCreating a false sense of scarcity or urgency can disturb people's ordinary decision-making process.
- 9TrustBeing convincing (or establishing trust) usually depends on the attacker obtaining privileged information about the organization. For example, an impersonation attack is much more effective if the attacker knows the user's name.
- 10Dumpster DivingCombing through an organization's (or individual's) refuse to try to find useful documents
- 11Shoulder SurfingStealing a password or PIN (or other secure information) by watching the user type it.
- 12Lunchtime AttackIf a user leaves a logged on workstation unattended, an attacker can gain access to the system using the logged on profile.
- 13Tailgating (or piggybacking)1. Entering a secure area without authorization by following close behind the person that has been allowed to open the door or checkpoint.
2. persuade someone to hold a door open, using an excuse such as "I've forgotten my badge / key". - 14PhishingObtaining user authentication or financial information through a fraudulent request for information. Phishing is specifically associated with emailing users with a link to a faked site (or some other malware that steals the information they use to try to authenticate).
- 15Spear Phishingattacks directed at a specific group or organization with the intent to steal intellectual property, financial data, trade or military secrets and other confidential data.
- 16WhalingAttacks directed at senior management and executives.
- 17VishingPhishing attack conducted through a voice channel (telephone or VoIP for instance).
- 18SMiShingShort for SMS Phishing, smishing is a variant of phishing email scams that instead utilizes Short Message Service (SMS) systems to send bogus text messages.
- 19PharmingAttacker uses DNS spoofing to redirect the user to the fake site.
- 20Watering Hole AttackRelies on the probability that a particular group of targets may use an insecure third-party website.
- 21Mitigating Social Engineering Attacks1. Train employees only to release information or make privileged use of the system only according to standard procedures.
2. Establish a reporting system for suspected attacks.
3. Train employees to identify phishing and pharming style attacks plus new styles of attack as they develop in the future.
4. Train employees not to release any work-related information on third-party sites or social networks.
5. Ensuring documents and information is destroyed before disposal.
6. Using multi-factor access control, to put more than one or two barriers between an attacker and his or her target. - 22MalwareCatch-all term to describe malicious software threats and social engineering tools designed to vandalize or compromise computer systems.
- 23Computer VirusesComputer viruses are programs designed to replicate and spread amongst computers, usually by "infecting" executable applications or program code.
- 24Boot sector virusesAttack the boot sector information, the partition table, and sometimes the file system.
- 25Program virusesSequences of code that insert themselves into another executable program. When the application is executed, the virus code becomes active.
- 26Script virusesScripts are powerful languages used to automate OS functions and add interactivity to web pages. Scripts are executed by an interpreter rather than self-executing. Most script viruses target vulnerabilities (exploits) in the interpreter.
- 27Macro virusesAffect Microsoft Office documents, and have become very prevalent because of the wide distribution of these documents, especially over the internet.
- 28Multipartite virusesUse both boot sector and executable file infection methods of propagation.
- 29WormsMemory-resident viruses that replicate over network resources. It is self-contained i.e. does not need human intervention. The primary effect of a worm infestation is to rapidly consume network bandwidth as the worm replicates.
- 30Logic BombsPiece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met.
- 31Virus Alert HoaxFalse warning about a computer virus. Typically, the warning arrives in an e-mail note or is distributed through a note in a company's internal network.
- 32SpamUnsolicited email messages, the content of which is usually advertising pornography, miracle cures for various personal conditions, or bogus stock market tips and investments.
- 33Trojan HorseProgram in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage.
- 34BackdoorA remote administration utility providing a means of configuring a computer. Remote admin software may be installed intentionally, in which case it must be properly secured. Backdoors may also be installed by malware.
- 35BotnetA network of computers that have been compromised by Trojan / rootkit / worm malware. Providing the botnet can also subvert any firewalls between the controller (or "herder") and the compromised computers ("zombies"), they can be remotely controlled and monitored using covert channels. The internet contains botnets of many millions of computers and their exploitation (mostly to send spam or for identity theft) is a robust part of the "shadow" economy.
- 36RootkitA class of malware (typically a Trojan, which is to say the user believes they are installing something else) that modifies system files, often at the kernel level, to conceal its presence.
- 37SpywareSoftware that monitors a user's activity. Spyware is distinguished from adware either by installing itself without the user's informed consent or by collecting data for criminal purposes (key logging authentication information for instance).
- 38AdwareSoftware that monitors a user's internet activity and displays correspondingly targeted ads (or collects data for other marketing purposes). Adware may be installed alongside another application but is distinguished from Trojans and spyware by transparently seeking the user's consent.
- 39RansomwareType of malware that tries to extort money from the victim.
- 40Preventing Malware1. Carry out regular backups.
2. Apply OS and application security patches.
3. Install (and keep up-to-date) a virus checker on workstations and servers.
4. Configure filtering on the messaging server
5. Properly secure servers and workstations
6. Educate users about not running untrusted installers and browser plug-ins.
7. Educate users to help them identify phishing sites by inspecting the URL.
8. Audit system events (such as logons) and review logs for unusual activity. - 41Anti-Virus SoftwareSoftware capable of detecting and removing virus infections and (in most cases) other types of malware, such as worms, Trojans, rootkits, adware, spyware, password crackers, network mappers, DoS tools, and so on. Anti-virus software works on the basis of both identifying malware code (signatures) and detecting suspicious behavior (heuristics). Anti-virus software must be kept up-to-date with the latest malware definitions and protect itself against tampering.
- 42Stealth VirusIntercepts commands from anti-virus software and passes the software a clean version of the file;alternatively the virus may "jump" from file-to-file ahead of the virus scanner.
- 43Polymorphic virusChanges its binary code each time it infects a new file. Without an identifiable pattern to match, it is extremely difficult to discover under normal methods.
- 44VirusCode designed to infect computer files (or disks) when it is activated. A virus may also be programmed to carry out other malicious actions, such as deleting files or changing system settings.
- 45Metamorphic virusCompletely re-compiles itself to infect new files.
- 46Armor VirusVirus code is protected, making it difficult for anti-virus software to analyze it. One technique is to obfuscate the virus code by putting unnecessary or misleading routines in it to make it hard to analyze and identify the virus' true structure and purpose.
- 47RetrovirusVirus seeks to disable the anti-virus software.
- 48Slow and sparse infectorsThese attempt to stay "under the radar" by replicating slowly.
Informações
- Descrição
- FlashCards sobre Unit 1.2 / Threats and Attacks / Study Notes, criado por avernef em 05-06-2015.
- Criado por
- avernef
- Visualizações
- 0
- Avaliação